CN103139185A - Method of achieving safe reverse proxy service - Google Patents

Abstract

The invention discloses a method of achieving a safe reverse proxy service. The method comprises that a safe reverse proxy server is arranged on a gateway device, a safe gateway device is arranged between a client-side and an application server, the client-side and a gateway are in security socket layer (SSL) connection, a secure channel is built, the data between the client-side and the gateway are enabled to be enciphered data, and the data are prevented from being eavesdropped. Simple uniform resource identifier (URI) realm name identification is supported on the reverse proxy server, and the arrangement of realm names under a networking environment is reduced.

Description

A kind of method that realizes the secure reverse proxy service

One, technical field

The present invention relates to the secure reverse proxy server field; more particularly set up security gateway between the network of inside and outside; the secure reverse proxy server is set on gateway, and protection internal applications server avoids being destroyed, and strengthens the method and apparatus of the fail safe of internal applications server.

Two, background technology

At present both at home and abroad large and medium-sized enterprise all arranges many application servers in enterprises, offers help for the convenience that internal enterprise resources uses, and comprising: enterprises mail service, synergetic office work system, financial management system etc.When the enterprise customer uses external network to access each application system by acting server, generally this acting server is become Reverse Proxy.For this Reverse Proxy, do not preserve the True Data of any webpage on server, all static Web pages and WEB program all still are kept on the application server of enterprises.Attack to Reverse Proxy can't make the application server of enterprises be destroyed, and has so just strengthened the fail safe of enterprises application server.

Reverse Proxy is all the agencies that support HTTP at present, but along with the safe class that day by day improves, common HTTP reverse proxy can not be satisfied the needs of large and medium-sized enterprise's internet security, the more perfect security mechanism of its exigence satisfies higher security needs, this method provides a kind of mechanism that increases authentication and encryption and decryption in the reverse proxy service to strengthen the fail safe of external reference, and a kind of method that reduces the enterprises domain name is provided simultaneously.

Three, summary of the invention

The invention provides a kind of method of safe reverse proxy.Accompanying drawing 1 has been described its subordinate's environment, namely at gateway device deploy secure reverse proxy server, security gateway equipment is between client and application server, the address of client and application server is the different segment address, the address of two network segments is set on gateway device, specify simultaneously the domain name www.gateway.com of gateway and the address that domain name is pointed on dns server, the address is gateway device and client mutual address.

Before gateway device starts Reverse Proxy, be configured for acting server and agency's application server, the configuration main contents are as follows:

The error message page: by the simple html page of gateway self-defining; (essential)

Service end certificate: the certificate of being signed and issued by third party's trust authority; (essential)

PKI: the PKI that is complementary with certificate; (essential)

/ XXX: the abbreviation of application server; (essential)

Proxy_IP_PORT: the real ip address of application server and port numbers; (essential)

Header information is set: X-REAL-IP, X-Forwarded-For.(optional)

Above-mentioned configuration can be according to the reverse proxy of different a plurality of application servers of application server configuration except certificate, and the gateway configuration fire compartment wall is opened the access authorization of 443 ports simultaneously.The TCP that startup Reverse Proxy after configuration is completed, Reverse Proxy utilize the Socket technology to monitor 443 ports connects, and waits for the safe connection request that client is initiated.Client is keyed in https on browser: //www.gateway.com/XXX, the initiation destination interface is 443 TCP connection.Www.gateway.com is the domain name of gateway, and/XXX is the abbreviation of the access application period of service, and service end should configure simultaneously/and address and the URL that need to return to client of XXX application service phase pointed specify.The TCP of client and service end consults to be normal TCP three-way handshake, the successfully rear beginning SSL negotiation on the basis of TCP of shaking hands.

SSL consults to adopt unidirectional negotiation, and accompanying drawing 2 has been described its negotiation step, and particular content is as follows:

1, the information such as the cryptographic algorithm its supported by SSL Hello message of client, Diffie-Hellman, MAC algorithm send to server.

2, gateway is divided into three parts with message, and first determines the encryption suite that this communication is adopted, by the Hello message informing to client; Second portion passes through the Certificate message informing to client, the certificate that this certificate is signed and issued for third party's trust authority with the digital certificate of own public key information; Third part gateway notice client release and encryption suite are consulted to finish, and begin to carry out cipher key change.

3, the certificate legitimacy of client validation gateway, the random preposition safe number that generates of the public key encryption client in certificate of utility, and send to service end by message.Client sends Change Cipher Spec message, and the key that notification service end subsequent packet consults employing and encryption suite are encrypted with MAC and calculate.Client is calculated the hash value of mutual handshake information (all mutual message except Change Cipher Spec message), the key that utilization consults and encryption suite are processed hash value (calculate and add MAC value, encryption etc.), and send to service end by Finished message.

4, the service end profit uses the same method and calculates the hash value of mutual handshake information, and with the decrypted result of Finished message relatively, if both identical, and the MAC value is proved to be successful, and proves that key and encryption suite consult successfully.Similarly, service end sends Change CipherSpec message, and the key that notice client subsequent packet consults employing and encryption suite are encrypted with MAC and calculate.Service end is calculated the hash value of mutual handshake information, utilizes the key that consults and encryption suite to process hash value (calculate and add MAC value, encryption etc.), and sends to client by Finished message.The client profit uses the same method and calculates the hash value of mutual handshake information, and with the decrypted result of Finished message relatively, if both identical, and the MAC value is proved to be successful, and proves that key and encryption suite consult successfully.

So far, SSL consults to complete, and encryption channel is set up.The key that client sends the SSL negotiation is encrypted the HTTP message, data after encrypting are sent to gateway, gateway reverse proxy module is called the SSL decryption function and is decrypted, carry out again the parsing of HTTP message after deciphering, the foundation of encryption channel can guarantee that client-access is enciphered data to the data of this one-phase of gateway, is blocked or reveals also can user and enterprise not exerted an influence as message.

The reverse proxy module is not resolved whole HTTP message, and it only resolves request row, the message header of HTTP message, and HTTP request text is not resolved.

Universal resource identifier (being HTTP URI) to HTTP request row is resolved, and determines that URI is "/XXX "; Whether search has/config option of XXX application server proxy, if do not have, return to HTTP 502 mistakes, and what return is the self-defined page herein, avoids client can understand the catalogue structure of application server by the wrong page; If the agency is arranged, the relevant configuration of taking-up/XXX, resolving the HTTP head.

Resolve the HTTP message header, extract the total Options of HTTP message header, comprise: " total Options such as Accept, Accept-Language, User-Agent, Accept-Encoding, Host, Connection, Cookie, and option and option content are preserved;

Create a new BUF, re-construct HTTP request row and message header:

Re-construct HTTP option Host, this option content is Reverse Proxy configuration domain name;

As configured the protocolHeader option, create HTTP option protocolHeader, this option content is https: //, this option only is sign, general expression Reverse Proxy has received the negotiation of HTTPS, and data are deciphered, it processes the application server general tree;

As configured the X-Forwarded-For option, create HTTP option X-Forwarded-For, this option content is actual customer end IP address, whether selecting to add this option herein should judge according to application server, as when being deployed as take the IP address ballot system as restriction, this option must be set, the real IP of the requesting client end of HTTP is sent to application server, avoid application server add up and make statistics inaccurate with the source address of IP head;

As configured the X-REAL-IP option, and creating HTTP option X-REAL-IP, this option is actual direct reference;

Re-construct HTTP option Connection, this option content is close.

Other HTTP options will not be revised, after completing the encapsulation of HTTP heading, according to application server address and the port numbers of/XXX appointment, message is sent to the application service phase, the application service phase returns to gateway with message after resolving, gateway with data penetration transmission to client, for data, the data of application server passback, gateway is not do change, so gateway is transparent to the user.If but application server returns to error message, acting server can intercept in advance this message and change any URL that lists in header, and then message is sent to client computer.Prevent that external client from obtaining the Redirect URL of inner content server.

Due in Reverse Proxy/XXX, can be interpreted as the address of application server, therefore, can delete this domain name on dns server under the network environment of reality, avoid domain name occupied.

The realization of gateway is adopted to aim at the industrial computer of gateway designs and the Liunx operating system of reduction based on hardware and the operating system of customization, and the realization of above-mentioned algorithm is based on my the own realization of company, and it mainly is embodied as two modules:

1. data are processed submodule

It is security gateway and extraneous mutual unique gateway that data are processed submodule, it adopts the multi-course concurrency transaction module, start simultaneously 1 host process and 8 subprocesss carry out work, host process is responsible for controlling the configurations information of reverse proxy engine modules, subprocess and sending/receiving data and transmission data.

Data are processed submodule and are utilized the realization of Socket technology to the monitoring of port, after receiving the request that client is initiated, call the intermediate layer submodule negotiation packet is processed (process of handling through consultation consults to be responsible for processing by the intermediate layer submodule).The transmitting-receiving of data all adopts streaming Socket (connection-oriented Socket) to complete.After data are processed the submodule receive data, according to message purpose IP address, judge, when a certain rule was satisfied in the ipTables of system in purpose IP address, the interface that message is pointed to according to rule forwarded.

2. intermediate layer submodule

The intermediate layer submodule is responsible for the negotiation of ssl protocol, consults to complete by the deciphering interface SSL_read that rear data processing submodule calls open ssl the decryption oprerations of data.

Four, description of drawings

[Fig. 1]: security gateway deployed environment

[Fig. 2]: unidirectional SSL negotiations process

Claims (8)

1. a gateway is as the method for secure reverse proxy server, and described gateway is arranged between user and server on network, and described method comprises step:

(1) client connects 443 ports that Reverse Proxy is opened on gateway, sets up TCP after three-way handshake and connects, and connects on the basis at TCP and sets up the SSL safe lane;

(2) after safe lane was set up, gateway received the encrypted HTTP request that client sends to application server, and gateway is decrypted processing to this request;

(3) after the deciphering, gateway is resolved the HTTP message, according to the URI that resolves, judges the application server of reverse proxy appointment;

(4) continue to resolve the HTTP header, the HTTP head is transformed, after increase division header information, message is sent to server forever.

2. the method for claim 1, is characterized in that gateway can receive the TCP connection of 443 ports.

3. the method for claim 1, it is characterized in that TCP connect set up after, client and gateway carry out the SSL negotiation.

4. the method for claim 1, after it is characterized in that SSL consults to complete, the HTTP data that client sends are enciphered data, gateway just can be resolved after to the data deciphering.

5. the method for claim 1, is characterized in that gateway comprises identification HTTP request, and the device to asking head to be resolved.

6. the method for claim 1 is characterized in that gateway can construct division header information, and according to the different header information of actual needs structure of application server.

7. the method for claim 1, is characterized in that gateway comprises the replacement Web server device that request is replied to client side HTTP.

8. the method for claim 1, is characterized in that gateway comprises the device that packet is carried out port repeat.

Images